PT-2026-36321

CVE-2026-7580

Published

2026-04-01

Updated

2026-08-19

Description by

CVSS 3.1

5.3

Medium

MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Exiftool versions prior to 13.54

Description Local code injection is possible through the manipulation of the -ee argument. The issue resides in the Process mrld() function within the lib/Image/ExifTool/GM.pm file, specifically affecting the JPEG, QuickTime, MOV, and MP4 components.

Recommendations Upgrade to version 13.54.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

Related identifiers